{"id":2474974,"url":"https://alion.io/job/tbi-bank-security-engineer-detection-identity","title":"Security Engineer – Detection & Identity","company":{"id":289460,"name":"tbi bank","domain":"tbibank.bg","url":"https://alion.io/company/tbibank","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Recruitee","truth_index":null},"role":"Security","role_family":"Security","seniority":null,"employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Sofia, Bulgaria"],"countries":["BG"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Anomaly Detection","optional":false},{"name":"IAM","optional":false},{"name":"Linux","optional":false},{"name":"SIEM","optional":false},{"name":"Unix","optional":false},{"name":"Windows","optional":false},{"name":"AWS","optional":true},{"name":"Azure","optional":true}],"status":"live","first_seen_at":"2026-10-12T08:33:47Z","employer_posted_date":"2026-10-12","last_verified_at":"2026-10-23T20:45:14Z","board_verified":true,"closed_at":null,"days_open":11,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":11},"description":"Join the best bank to work for in Bulgaria*\nWho we are:\nDo you want to join a well-established bank with a start-up culture? No, we’re not joking!\nWe, at tbi, have been one the most profitable banks for years and we are growing at a fast pace. We’re a bank with a long history of success that operates as a start-up and we’re always on the lookout for new opportunities to grow our business. How do we do that?\nIt's all about our people. Our team is made up of brave, passionate and caring people who don’t just want to follow the same path - we want to transform into mobile-first, state-of-the-art lifestyle ecosystem. Our colleagues love working here - 70% of them would recommend tbi as an employer to their friends and family. Our people are engaged in challenging and meaningful work, inspired to grow their potential and career, encouraged to learn and empowered to take decisions. That’s not corporate babble, it’s what our people say.\nDo you want to play a key role in our unique success story?\nWe are looking for a strong, hands-on Security Engineer to build and operate our detection and identity capabilities. You will implement and run our SIEM, identity and access management (IAM) and user behaviour analytics (UEBA), and lead security incident detection and response, working across security, infrastructure and fraud teams. This is a senior individual-contributor role focused on deep technical implementation rather than people management - we are looking for a builder, not only an operator.\nWhat You’ll do:\nImplement, configure and operate the Bank’s SIEM - log onboarding, correlation rules, detection use cases and alerting.\n\nDesign and build detection content for threats including account abuse, enumeration, anomalous access and insider risk.\n\nImplement and improve identity and access management (IAM) controls - access governance, privileged access, joiner-mover-leaver and access reviews.\n\nImplement user and entity behaviour analytics (UEBA) and correlate activity to identities for risk-based detection.\n\nConfigure monitoring for anomaly detection and automated response across cloud and hybrid environments.\n\nCoordinate and investigate information security incidents and lead technical incident response.\n\nAnalyse large datasets and security logs from network, infrastructure and application sources.\n\nDevelop scripts and automation for detection, enrichment and response (SOAR).\n\nSupport the definition and control of access rights to information and critical systems.\n\nEvaluate and help implement new detection, identity and monitoring technologies.\n\nRequirements\nWhat you’ll need to succeed:\nBachelor’s or Master’s degree in Information Technology, Computer Science, Cybersecurity or a related field.\n\nProven hands-on experience in security monitoring, detection or incident response, ideally in a financial institution, technology company or another highly regulated environment.\n\nStrong knowledge of:\n\nSIEM implementation and detection engineering;\nIdentity and access management (IAM) and privileged access;\nUser and entity behaviour analytics (UEBA) concepts;\nIncident detection, response and investigation;\nNetwork communications, enterprise application architecture and cloud technologies;\nWindows and Linux/UNIX operating systems.\nExperience with SIEM, EDR/XDR, UEBA, SOAR or vulnerability-management platforms is highly desirable.\n\nAbility to analyse large datasets and security logs; scripting and automation skills.\n\nStrong analytical and problem-solving skills; excellent command of English (written and spoken).\n\nProfessional certifications such as CompTIA Security+, CEH, CISSP, GIAC (e.g. GCIA, GCIH), Azure/AWS Security, ISC2 or equivalent are considered an advantage.\n\nWhat we offer:\nTake your career to the next level with real growth opportunities\n\nWork on exciting, meaningful projects that make an impact\n\nBe seen and appreciated for who you are and what you do\n\nJoin a vibrant, international team of 23 nationalities who’ve got your back\n\nStay covered with additional private health insurance\n\nReceive monthly food vouchers as part of your benefits package\n\nEnjoy exclusive perks & discounts - from Multisport cards to top retailers\n\nBenefit from special rates on our banking products\n\nWork in the heart of Sofia - steps away from National Palace of Culture and South Park\n\nBring your furry friend to work - because every office is better with paws\n\nVisit our Career Page to learn more about what makes us different.\nIf this sounds like something you’d be interested in, we'd love to hear from you!\nTo apply for this position, please send us your CV in English.\nWe'd love to get back to everyone, but due to the number of applications we receive, we can only contact the shortlisted candidates.\n*We are ranked the top bank and top 3 employer to work for in Bulgaria according tо WhereWeWork 2025 employer ranks.\nAll applications are treated with utmost confidentiality.\nBy submitting your job application to tbi bank, you confirm that you have read the document named “Information related to personal data processing for job applicants” publicly available on tbi Career page.","description_format":"text","description_chars":5130,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[{"language":"English","level":"All levels","optional":false}]},"benefits":["Growth opportunities","Health insurance"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Commercial & Retail Banks"],"lifecycle":[{"event":"open","at":"2026-10-13T21:05:17Z"}],"visa":[],"liveness":{"score":74,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.82,"p_room":0.9,"age_days":10,"expected_fill_days":31,"reasons":["conf:3","velocity","win:mid"],"computed_at":"2026-10-23T05:54:15Z"},"pay":null,"html_url":"https://alion.io/job/tbi-bank-security-engineer-detection-identity","json_url":"https://alion.io/job/tbi-bank-security-engineer-detection-identity.json","meta":{"generated_at":"2026-10-23T22:34:10Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":5395,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-24T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":289460},"rest":"https://alion.io/mcp/rest/get_company?id=289460"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Ftbi-bank-security-engineer-detection-identity"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Ftbi-bank-security-engineer-detection-identity"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Ftbi-bank-security-engineer-detection-identity"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/tbi-bank-security-engineer-detection-identity\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Ftbi-bank-security-engineer-detection-identity"}]}